Logging denied packets (iptables)
Mike Wohlgemuth
mjw at woogie.net
Wed Oct 17 18:16:55 UTC 2007
On Wed, October 17, 2007 2:05 pm, Ashley M. Kirchner wrote:
>
> One of our offices has several network ranges blocked in iptables
> (essentially '-A INPUT -s www.xxx.yyy.zzz/aa -j DROP'). What I'd like
> to do is create a log entry each time a packet is dropped, IF it matches
> any of those networks. I think I need to assign all of those networks
> to a "group" and then log dropped packets from that group only. And
> while I realize this might have other ramifications, such as logs
> growing exponentially, for now we're taking small steps. Later on I can
> then look for things like logging the same IP only once...
>
> So how do I tell iptables to create a group or name, or whatever
> it's called for those ranges, and then log dropped packets from those
> ranges only?
Here's what I do:
-N LOGDROP
-A LOGDROP -j LOG --log-prefix "$IPTABLES drop:"
-A LOGDROP -j DROP
Then you can add lines for the things you want logged like this:
-A INPUT -s www.xxx.yyy.zzz/aa -j LOGDROP
I tend to use LOGDROP, rather than DROP, for everything I drop, except for
some really common things.
Mike
More information about the fedora-list
mailing list